Risk Management in Information Systems Projects
Total Page：16
File Type：pdf, Size：1020Kb
1 Risk Management in Information Systems Projects Luca Álvares Guedes Vaz [email protected] Instituto Superior Técnico, Lisboa, Portugal May 2016 Although there are several Risk Registers, they lead to a Abstract— All Information Systems Projects involve risk of problem where they may have common objectives and some sorts and these projects are becoming increasingly complex, purposes, but are structured in different ways. intensifying therefore the probability of various risks. Risks This big diversity of Risk Registers is the problem cannot be avoided but they can be managed in ways that they are recognized and their impacts accepted, avoided, mitigated or addressed by this work, resulting in a proposal for a generic transferred. Frameworks like, PMBOK and PRINCE2 provide Reference Risk Register. guidance and principles that contribute to achieving success in Risk Management processes in Project Management. The Risk register, sometimes referred to as risk log, is a key 2. RELATED WORK part of documenting any risk analysis effort and one of the most important supporting tools of risk management, enabling storage 2.1 ISO Standards and communication of information in a relevant, consistent and concise manner. This could take various forms such as a The International Standard, ISO 31000:2009, entitled Risk spreadsheet or database and will act as a central repository for Management – Principles and Guidelines [1] , will ensure that the information gained on each risk. the information about risk derived from these processes is The purpose of this dissertation is to propose a reference risk adequately reported and used as a basis for decision-making at register, based specific a domain model, following a methodology all relevant organizational levels. This framework is intended which will allow the creation of a Reference Risk Register. to assist the organization to integrate risk management into its management system. The risk management process should be Keywords—Risk Management, Risk Register and Project Management an integral part of management, embedded in the culture and practices, and adapted to the business processes and context of the organization. 1. INTRODUCTION The processes for Risk management implementation is presented in Figure 1. All projects have risks. These risks come from the nature of the work, from the resources, the contractual relationships or the political factors. The subject of risk management has become increasingly important for different organizations. This is the result of the increasing use of projects in association with project management techniques, which are needed for achieving desired changes in the organizations. Considering that cooperation amongst organizations is fundamental, compliance with international standards is important for better acceptance of process activities and objectives. Risk Register, sometimes referred to as risk log, is a key part of documenting any risk analysis effort and one of the Figure 1.ISO31000 Risk Management Processes. Extracted from [7] most important supporting tools of risk management, enabling storage and communication of information. But all the risk The ISO 31000 is important for this dissertation because it Registers found were not consistent, thus making it difficult to focuses on frameworks for risk management and processes to structure, being that there is such diversity to the structure, this implement it. These frameworks are an important and complex makes it quite difficult and complicated for one to reuse and area of project management and will constitute the basis for compare them. developing the narrative of this dissertation. There is also the ISO Guide 73:2009 [3] that provides the definitions of generic terms related to risk management. It provides a coherent 2 approach to the description of activities relating to the 3 PROBLEM ANALYSIS management of risk, and the use of risk management 3.1 Risk Management in Project Management terminology in processes and frameworks dealing with the management of risk. In this dissertation, Risk Management is considered a The ISO 21500 is an international standard, which is intended Project Management process. to provide guidance, explain core principles and what Effective risk management strategies allow the constitutes good practice in project management. identification of a project’s strengths, weaknesses, ISO 21500:2012, Guidance on Project Management, as quoted opportunities and threats. To ensure the project’s success, we in [6] :”ISO 21500 provides generic guidance on the concepts must define how we will handle potential risks so we can and processes of project management that are important for identify, mitigate or avoid problems when needed. the successful realization of projects.” This ISO can be used The benefits of risk management in projects are huge. The by any type of organization, including public, any result will be the minimization of the impact of project threats organizations and for any type of project, regardless of and seizing of the opportunities that might occur. There are complexity, size and duration. It can be aligned with other some important steps to perform when using the risk standards, such as, ISO 31000:2009, Risk Management. management processes in projects. First always have a risk management strategy or a plan risk management, then identify 2.2 Relevant Frameworks risks early, communicate the risks, clarify ownership issues, prioritize risks, analyze risks, plan and implement risk The Guide to the Project Management Body of Knowledge responses, maintain a risk register and finally monitor the (PMBOK) provides guidance in individual projects risks. management and the concepts related to it [5] . Furthermore it There are some standards and some useful frameworks is very relevant in providing and promoting a common such as PMBOK and PRINCE2, as explained in section 2.1.2, vocabulary within the project management as this facilitates that are very similar in how they act in helping us to have a communication within the profession when using and applying good risk management strategy. project management concepts. The PMBOK adopts a modern education model for project management. It is organized as a body of knowledge, containing nine knowledge areas. One of the areas is Project Risk Management. PRINCE2 has some guidance on the management of risk in projects. It makes a distinction between business risk and project risk. Business risk, which is the responsibility of the project board, relates to things that might damage the business case. Project risks are those things, which could prevent the achievement of the project objectives. PRINCE2 recommends that an assessment of risk should be made at the inception of a project and that risks should thereafter be reviewed at significant points in the lifecycle of the project, such as the transition between stages. This framework is a scalable, flexible project management method, suitable for use on any type and any size of project. In PRINCE2 the purpose of risk management is to identify, assess and control uncertainty and, as a result, to improve the ability of the project to succeed [9]. Basically the PMBOK and PRINCE2 are frameworks with Figure 2. The Risk Management Process. Extracted from [7] different processes, both somehow using the same definitions and methods in Risk Management. This also happens for other In Figure 2 is presented the generic risk management frameworks, some names are different but their purposes are process. the same. 3.2 The relevance of a Risk Register Risk register (sometimes referred to as risk log) is a key part of documenting any risk assessment effort (including the identification, analysis and the evaluation) and one of the most important supporting tools of risk management, enabling storage and communication of information in a relevant, consistent and concise manner. This could take various forms like a spreadsheet or database and will act as a central repository for the information gained on each risk. Most of the risk registers found were not consistent, it is also important to recognize that there is a great diversity of these risk registers, 3 which makes it very difficult to reuse and to compare between Besides the WBS there are also: them. OBS (Organization Breakdown Structure). In Table 1 are pointed the activities referred in ISO21500, Categorizing risks using the OBS shows where risks lie in PMBOK and PRINCE2, where the concept of risk register is relation to the areas of responsibility of the various referred to as an input or an output. individuals, teams or groups in the project organization, and can be used to propose appropriate risk owners for risks. ISO21500 risk INPUT OUTPUT CBS (Cost Breakdown Structure). Linking risks into processes the CBS allows the cost of risk impacts and planned risk Identify Risk Project Plans Risk Register responses to be mapped into the project budget, exposing Assess Risk Risk Register Prioritized Risks which cost elements are most uncertain, allowing Treat Risk Risk Register Risk responses calculation of an appropriate risk budget, and suggesting Control Risk Risk Register, Corrective actions where contingency might be required. Risk responses PMBOK risk INPUT OUTPUT RBS (Risk Breakdown Structure). Grouping risks processes by the RBS indicates common sources of risk, allowing Identify Risk Risk Management Risk Register preventative measures to be taken, and increasing the Plan, Project efficiency of risk responses by targeting root causes